- Allow the WAN link to also carry LANs when the uplink is PPPoE on a
VLAN with IPv6 off; only the PPP device counts as an uplink then, so
LAN traffic can never match WAN rules.
- Add router.rollback: router-arm / router-confirm / router-rollback
plus `nix run .#deploy`, a commit-confirm deployment flow.
- Wait for the LAN devices instead of the uplink in networkd
wait-online, so an unplugged uplink cannot block boot or activation.
- Add examples/desktop (single NIC, PPPoE on VLAN 1001) as
nixosConfigurations.example, built as a flake check.
Covered by the onestick and rollback VM tests and new assertion cases.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add an IPv4 helper lib (parse, netmask, cidr, overlap) and derive
router.lans.<name>.ipv4.subnet from address and prefixLength instead of
requiring it twice. New assertions reject invalid addresses, DHCP pools that
are reversed, outside the subnet or contain the router address, and
overlapping LANs.
Add `lib` unit tests and an `assertions` check that evaluates broken configs
and compares the exact error messages.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd,
a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time
assertions against lock-out and interface conflicts.
tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN
DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots
the same topology in tmux with one console pane per VM and the driver REPL.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
nilsandClaude Sonnet 5.5